Commerble: unauthorized access to the GALLERY·2 online shop through its EC platform

On October 16 system administration credentials of Commerble, the operator of the Commerble EC platform, were stolen, and on the 17th the customer database of GALLERY·2, a Xebio Holdings subsidiary, was accessed through the platform's management cloud and customer records were displayed. On the 18th the payment entry page of the online shop was found tampered with, and the shop was shut down. Weak access restrictions were reportedly exploited. Up to about 128,000 buyer names and emails, 122,000 addresses, delivery addresses and phone numbers, and 158,000 order confirmation emails are affected; card numbers and passwords are not included.